forust
0859479c0f
ci / lint-compose (push) Successful in 9s
ci / lint-actionlint (push) Successful in 4s
ci / lint-shellcheck (push) Successful in 7s
ci / lint-prettier (push) Successful in 12s
ci / lint-ruff (push) Successful in 6s
ci / lint-yaml (push) Successful in 9s
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 5s
renovate-ci / validate-renovate (push) Successful in 7s
ci / build (push) Failing after 14m22s
Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.
66 lines
1.7 KiB
YAML
66 lines
1.7 KiB
YAML
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: gitea-prod
|
|
namespace: gitea
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`gitea.forust.xyz`)
|
|
kind: Rule
|
|
services:
|
|
- name: gitea-service
|
|
port: 3000
|
|
# Registry route: NO crowdsec-bouncer.
|
|
# A deploy burst (runner Action API polls, `docker manifest inspect` per
|
|
# own image, containerd pulls, smoke probes) fires hundreds of parallel
|
|
# registry calls, and a ban on the runner breaks every later job. This
|
|
# route only serves authenticated OCI traffic - registry tokens and
|
|
# basic-auth are already handled by gitea - and scanners get nothing
|
|
# useful from /v2, so there is no bruteforce surface to protect here.
|
|
- match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
|
|
kind: Rule
|
|
services:
|
|
- name: gitea-service
|
|
port: 3000
|
|
tls:
|
|
secretName: gitea-prod-tls
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: gitea-local
|
|
namespace: gitea
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)
|
|
kind: Rule
|
|
services:
|
|
- name: gitea-service
|
|
port: 3000
|
|
- match: (Host(`gcr.workstation.internal`) || Host(`gcr.gigaforust.internal`)) && PathPrefix(`/v2`)
|
|
kind: Rule
|
|
services:
|
|
- name: gitea-service
|
|
port: 3000
|
|
tls:
|
|
secretName: internal-wildcard-tls
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRouteTCP
|
|
metadata:
|
|
name: gitea-ssh
|
|
namespace: gitea
|
|
spec:
|
|
entryPoints:
|
|
- ssh
|
|
routes:
|
|
- match: HostSNI(`*`)
|
|
services:
|
|
- name: gitea-service
|
|
port: 2221
|